CN103810441A - Multi-granularity remote sensing data access method based on rules - Google Patents

Abstract

The invention discloses a rule-based multi-granularity remote sensing data access method, which includes the following steps: (1) user login, assigning different roles to the user according to the user's organizational relationship, each role corresponds to a set of basic permissions, the basic Permissions grant users access to coarse-grained remote sensing data; (2) When a user sends an access request to fine-grained remote sensing data, the access request is parsed according to authorization rules to determine whether the access request is allowed, and if the access request is allowed , the user is authorized to access the corresponding fine-grained remote sensing data; if the access request is not allowed, the user is denied access to the corresponding fine-grained remote sensing data. According to the preset authorization rules, the present invention gives access rights to different roles individually, meets the increasingly complex remote sensing data access requirements, and can meet the security and confidentiality requirements of remote sensing data services.

Description

A rule-based multi-granularity remote sensing data access method

technical field

The invention relates to the technical field of remote sensing, in particular to a rule-based multi-granularity remote sensing data access method.

Background technique

With the development of global informatization, the increasing popularity of space technology, and the increasing application of high-tech such as cloud computing and the Internet of Things, higher requirements are put forward for remote sensing information services, which actively promotes the development of remote sensing information services.

During the "Twelfth Five-Year Plan" period, the state invested a lot of money to increase the number and variety of remote sensing satellites. China launched a number of remote sensing satellites, including a series of industrial satellite systems and combined constellations for meteorology, ocean and environment, which will form Massive multi-source remote sensing data with multiple resolutions, multiple types, and high coverage provides a data foundation for remote sensing information services, and China's remote sensing information services have entered a "golden period."

Remote sensing information services are developing towards multi-users, multi-applications and large-scale. The amount of data is increasing, and business relationships are becoming more and more complex. There is an increasing demand for data security in remote sensing systems, and remote sensing data often involves Considering issues such as military secrets, commercial secrets, and personal privacy, the security performance of remote sensing data should be considered in the first place.

Remote sensing data security is an indispensable part of remote sensing technology research and application, and data access control mechanism is an indispensable part of data security. However, due to the particularity and sensitivity of remote sensing data, general access control mechanisms often cannot To meet the system's requirements for access control of remote sensing data, the access control of remote sensing data often requires fine-grained control, such as specific to a certain attribute of the data, or consider the temporal and spatial relationship of the data.

Due to the lack of specifications and documents that comprehensively describe the security of remote sensing data, many remote sensing information services are only protected by user names and passwords, and sensitive data are not open. This is difficult to meet the needs of data sharing and seriously affects the national remote sensing technology. development of. Therefore, it is necessary to provide an access control method for remote sensing data to meet the security and convenience requirements of remote sensing data access.

Contents of the invention

The present invention provides a rule-based multi-granularity remote sensing data access method, through the pre-set authorization rules, different roles are given individualized access rights to meet the increasingly complex remote sensing data access requirements, and can meet the requirements of remote sensing data services Security and confidentiality needs.

A method for accessing multi-granularity remote sensing data based on rules, the multi-granularity remote sensing data includes coarse-grained remote sensing data and fine-grained remote sensing data, the coarse-grained remote sensing data includes remote sensing data sets, remote sensing databases and remote sensing data tables; the fine-grained Granular remote sensing data includes individual remote sensing data, remote sensing data records, and remote sensing data attributes;

The multi-granularity remote sensing data access method includes the following steps:

(1) User login, assign different roles to users according to their organizational relationship, each role corresponds to a set of basic permissions, and the basic permissions give users access to coarse-grained remote sensing data.

Organizational relationships include actual organizations such as units and departments, temporary organizations such as project teams and academic circles, and even virtual organizations.

There is a many-to-many relationship among users, roles, and basic permissions, that is, a user may correspond to multiple roles, and a role may correspond to multiple basic permissions (multiple basic permissions constitute a set of permissions). Through role assignment, users can Obtain basic permissions, that is, gain access to coarse-grained remote sensing data.

(2) When the user issues an access request for fine-grained remote sensing data, the access request is analyzed according to the authorization rules to determine whether the access request is allowed,

If the access request is allowed, the user is authorized to access the corresponding fine-grained remote sensing data;

If the access request is not allowed, the user is denied access to the corresponding fine-grained remote sensing data. When the access request is not allowed, explain to the user why it is not allowed.

The access includes addition, deletion, modification, query and download of remote sensing data. After the user accesses the multi-granularity remote sensing data, the access process is recorded.

The parsing of the access request according to the authorization rules specifically includes the following steps:

2-1. Obtain the role of the user and the access request the user wants to make;

2-2. Determine whether the access request is allowed based on the characteristics of the fine-grained remote sensing data and the information obtained in step 2-1.

The rule-based multi-granularity remote sensing data access method of the present invention, combined with the role-based access control model and rule engine technology, realizes multi-granularity access control of remote sensing data services in the two dimensions of user and data, and improves the data security and security of remote sensing data services. Confidentiality, to promote the sharing and application of remote sensing data, through the dynamic addition, deletion and combination of remote sensing data authorization rules, to flexibly realize complex fine-grained access control, to meet the needs of responsible access logic, to optimize access control through state preservation, rule matching cache and other mechanisms performance, preventing complex access control from degrading system performance.

Description of drawings

Fig. 1 is the frame diagram of the rule-based multi-granularity remote sensing data access method of the present invention;

2 is a composition diagram of a verification system based on authorization rules in the rule-based multi-granularity remote sensing data access method of the present invention;

Fig. 3 is a composition structure diagram of authorization rules in the rule-based multi-granularity remote sensing data access method of the present invention;

Fig. 4 is a working flow chart of the rule engine in the rule-based multi-granularity remote sensing data access method of the present invention.

Detailed ways

The rule-based multi-granularity remote sensing data access method of the present invention will be described in detail below in conjunction with the accompanying drawings.

As shown in Figure 1, a rule-based method for accessing multi-grained remote sensing data. Multi-grained remote sensing data includes coarse-grained remote sensing data and fine-grained remote sensing data. Coarse-grained remote sensing data includes remote sensing datasets, remote sensing databases, and remote sensing data tables; Granular remote sensing data includes individual remote sensing data, remote sensing data records, and remote sensing data attributes;

The multi-granularity remote sensing data access method includes the following steps:

(1) User login, assign different roles to users according to their organizational relationship, each role corresponds to a set of basic permissions, and basic permissions give users access to coarse-grained remote sensing data.

When a user logs in, the mapping relationship between users, roles, and basic permissions is loaded into memory. Since these data are frequently used and the data volume is small, loading them into memory can speed up the verification of basic permissions.

(2) When the user issues an access request for fine-grained remote sensing data, the access request is analyzed according to the authorization rules to determine whether the access request is allowed,

If the access request is allowed, the user is authorized to access the corresponding fine-grained remote sensing data;

If the access request is not allowed, the user is denied access to the corresponding fine-grained remote sensing data.

Access to coarse-grained data uses the RBAC (Role-Based Access Control) model, and access to fine-grained remote sensing data uses authorization rules. After the user accesses the multi-granularity remote sensing data, the access process is recorded.

As shown in Figure 3, authorization rules are composed of decision-making, user classification, resource classification, operation, and description. Among them, decision-making includes two types of permission and denial, which are logically interchangeable; user classification refers to classifying users according to certain conditions. Divided into several categories; resources include interface elements, functional modules and remote sensing data objects, mainly referring to remote sensing data resources, resource classification refers to dividing remote sensing data resources into several categories based on certain conditions; operation is access, including for remote sensing data modification (including adding, deleting, modifying, querying) and downloading, when the resource is defined as an interface element or a functional module, the operation is null; it describes the information used to construct the authorization result, and when the access request is not allowed, the user is sent State the reason for disapproval.

User classification belongs to dynamic division, which is not exactly the same as role. Authorization rules are used to describe users. If a user satisfies the description of authorization rules, it belongs to a certain user classification. The affiliation relationship is obtained through the operation of authorization rules. Users are classified into a certain user category in advance.

Resource classification is also a dynamic division. Authorization rules are used to describe resources. If a resource satisfies the description of authorization rules, it belongs to a certain resource classification. The affiliation relationship is obtained through the operation of authorization rules without prior resource classification to a certain resource classification. .

The access request includes at least the following information: the user, the resource to be accessed, and the operation to be performed on the resource. Authorization rules can be set according to needs. For example, if the accuracy of remote sensing data to be accessed exceeds a certain threshold, only administrators are allowed to access it. By combining RBAC model and rule engine technology, flexible customization of remote sensing data services is realized.

Analyze the access request according to the authorization rules, and judge whether the access request is allowed. The permission and rejection of the access request are realized through the filter chain. The filter chain is composed of a set of filters in sequence, and each filter sets its own The interception condition, when the access request meets the interception condition, the filter will intercept and verify it, if it passes the verification, the access request will be handed over to the next filter, if the access request passes all filters, the access request will be allowed; if If the access request does not pass all the filters, the access request is denied.

According to the different remote sensing data to be accessed, the behavior of the filter chain can be divided into the following three types:

1) It is necessary to access coarse-grained remote sensing data, and only verify the basic permissions based on roles; that is, map user access requests to a corresponding set of permissions, and then look up the user's permission set in memory. If the user has all the permissions required by the access request Permissions, then the authentication passes to allow access, otherwise deny access.

2) It is necessary to access fine-grained remote sensing data and perform verification based on authorization rules;

The composition of the verification system based on authorization rules is shown in Figure 2, including a rule engine, a rule editor, a graphical management module, and a security service module (Spring Security). The functions of the rule engine include parsing, verification and authorization, and the rule editor The functions include formulating and testing rules. The graphical management module can display users, roles and permissions. The security log system is used to record logs. Based on Spring Security, role-based access control is realized, and the filter chain is used to control role-based and access control. Access flow based on authorization rules.

The verification process based on authorization rules is processed by the rule engine, as shown in Figure 4, and the verification steps are as follows:

a) The request filter and the rule engine are connected through a unified API interface;

b) The rule engine forwards the user in the access request and the resource to be accessed to the rule parser. At the same time, the rule engine accesses the rule base and forwards the rule information related to the access request in the rule base to the rule parser;

c. The rule parser parses and encapsulates the access request, and forwards the generated parsing result to the rule verifier; parsing specifically includes the following steps: 2-1, obtaining the role of the user, and the access request the user wants to make; 2-2, According to the characteristics of the fine-grained remote sensing data and the information obtained in step 2-1, it is judged whether the access request is allowed.

d. The rule verifier accesses the source data information (including user information and resource attributes) that needs to be verified according to the configuration file, and matches the source data information with the authorization rules to generate verification results;

e. The rule authorizer encapsulates the verification result and returns it to the request filter, and triggers the security log system to write logs.

f. The request filter accepts or rejects the user access request according to the verification result.

3) It is necessary to access coarse-grained remote sensing data and fine-grained remote sensing data at the same time, first verify the basic permissions based on roles, and then verify based on authorization rules.

Claims (5)

1. A rule-based access method for multi-grained remote sensing data, characterized in that the multi-granularity remote sensing data includes coarse-grained remote sensing data and fine-grained remote sensing data, and the coarse-grained remote sensing data includes remote sensing datasets, remote sensing databases, and remote sensing A data table; the fine-grained remote sensing data includes individual remote sensing data, remote sensing data records, and remote sensing data attributes; The multi-granularity remote sensing data access method includes the following steps: (1) User login, assign different roles to users according to their organizational relationship, each role corresponds to a set of basic permissions, and the basic permissions give users access to coarse-grained remote sensing data; (2) When the user issues an access request for fine-grained remote sensing data, the access request is analyzed according to the authorization rules to determine whether the access request is allowed, If the access request is allowed, the user is authorized to access the corresponding fine-grained remote sensing data; If the access request is not allowed, the user is denied access to the corresponding fine-grained remote sensing data. 2. The rule-based multi-granularity remote sensing data access method according to claim 1, wherein the access includes adding, deleting, modifying, querying and downloading remote sensing data. 3. The rule-based multi-granularity remote sensing data access method according to claim 1, characterized in that, in the step (2), when the access request is not allowed, explain the reason for not being allowed to the user. 4. The rule-based multi-granularity remote sensing data access method according to claim 1, wherein after the user accesses the multi-granularity remote sensing data, the access process is recorded. 5. The rule-based multi-granularity remote sensing data access method according to claim 1, wherein said parsing the access request according to authorization rules specifically comprises the following steps: 2-1. Obtain the role of the user and the access request the user wants to make; 2-2. Determine whether the access request is allowed based on the characteristics of the fine-grained remote sensing data and the information obtained in step 2-1.

Images